diff --git a/Release.toml b/Release.toml
index b8e842289d5..11faab01485 100644
--- a/Release.toml
+++ b/Release.toml
@@ -227,4 +227,8 @@ version = "1.15.0"
     "migrate_v1.15.0_seccomp-default-setting.lz4",
     "migrate_v1.15.0_oci-defaults-docker-setting.lz4",
     "migrate_v1.15.0_oci-defaults-docker-setting-metadata.lz4",
+    "migrate_v1.15.0_aws-admin-container-v0-11-0.lz4",
+    "migrate_v1.15.0_public-admin-container-v0-11-0.lz4",
+    "migrate_v1.15.0_aws-control-container-v0-7-4.lz4",
+    "migrate_v1.15.0_public-control-container-v0-7-4.lz4",
 ]
diff --git a/sources/Cargo.lock b/sources/Cargo.lock
index 91578b41c3d..4e4521d1908 100644
--- a/sources/Cargo.lock
+++ b/sources/Cargo.lock
@@ -526,6 +526,13 @@ dependencies = [
  "migration-helpers",
 ]
 
+[[package]]
+name = "aws-admin-container-v0-11-0"
+version = "0.1.0"
+dependencies = [
+ "migration-helpers",
+]
+
 [[package]]
 name = "aws-admin-container-v0-9-4"
 version = "0.1.0"
@@ -591,6 +598,13 @@ dependencies = [
  "migration-helpers",
 ]
 
+[[package]]
+name = "aws-control-container-v0-7-4"
+version = "0.1.0"
+dependencies = [
+ "migration-helpers",
+]
+
 [[package]]
 name = "aws-credential-types"
 version = "0.55.3"
@@ -3054,6 +3068,13 @@ dependencies = [
  "migration-helpers",
 ]
 
+[[package]]
+name = "public-admin-container-v0-11-0"
+version = "0.1.0"
+dependencies = [
+ "migration-helpers",
+]
+
 [[package]]
 name = "public-admin-container-v0-9-4"
 version = "0.1.0"
@@ -3089,6 +3110,13 @@ dependencies = [
  "migration-helpers",
 ]
 
+[[package]]
+name = "public-control-container-v0-7-4"
+version = "0.1.0"
+dependencies = [
+ "migration-helpers",
+]
+
 [[package]]
 name = "quick-xml"
 version = "0.26.0"
diff --git a/sources/Cargo.toml b/sources/Cargo.toml
index 9b34dabd62a..119fca65ea9 100644
--- a/sources/Cargo.toml
+++ b/sources/Cargo.toml
@@ -62,6 +62,10 @@ members = [
     "api/migration/migrations/v1.15.0/seccomp-default-setting",
     "api/migration/migrations/v1.15.0/oci-defaults-docker-setting",
     "api/migration/migrations/v1.15.0/oci-defaults-docker-setting-metadata",
+    "api/migration/migrations/v1.15.0/aws-admin-container-v0-11-0",
+    "api/migration/migrations/v1.15.0/public-admin-container-v0-11-0",
+    "api/migration/migrations/v1.15.0/aws-control-container-v0-7-4",
+    "api/migration/migrations/v1.15.0/public-control-container-v0-7-4",
 
     "bloodhound",
 
diff --git a/sources/api/migration/migrations/v1.15.0/aws-admin-container-v0-11-0/Cargo.toml b/sources/api/migration/migrations/v1.15.0/aws-admin-container-v0-11-0/Cargo.toml
new file mode 100644
index 00000000000..bc3a3f49342
--- /dev/null
+++ b/sources/api/migration/migrations/v1.15.0/aws-admin-container-v0-11-0/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "aws-admin-container-v0-11-0"
+version = "0.1.0"
+authors = ["Zac Mrowicki <mrowicki@amazon.com>"]
+license = "Apache-2.0 OR MIT"
+edition = "2021"
+publish = false
+# Don't rebuild crate just because of changes to README.
+exclude = ["README.md"]
+
+[dependencies]
+migration-helpers = { path = "../../../migration-helpers", version = "0.1.0"}
diff --git a/sources/api/migration/migrations/v1.15.0/aws-admin-container-v0-11-0/src/main.rs b/sources/api/migration/migrations/v1.15.0/aws-admin-container-v0-11-0/src/main.rs
new file mode 100644
index 00000000000..683669da45f
--- /dev/null
+++ b/sources/api/migration/migrations/v1.15.0/aws-admin-container-v0-11-0/src/main.rs
@@ -0,0 +1,27 @@
+use migration_helpers::common_migrations::ReplaceTemplateMigration;
+use migration_helpers::{migrate, Result};
+use std::process;
+
+const OLD_ADMIN_CTR_TEMPLATE: &str =
+    "{{ ecr-prefix settings.aws.region }}/bottlerocket-admin:v0.10.2";
+const NEW_ADMIN_CTR_TEMPLATE: &str =
+    "{{ ecr-prefix settings.aws.region }}/bottlerocket-admin:v0.11.0";
+
+/// We bumped the version of the default admin container
+fn run() -> Result<()> {
+    migrate(ReplaceTemplateMigration {
+        setting: "settings.host-containers.admin.source",
+        old_template: OLD_ADMIN_CTR_TEMPLATE,
+        new_template: NEW_ADMIN_CTR_TEMPLATE,
+    })
+}
+
+// Returning a Result from main makes it print a Debug representation of the error, but with Snafu
+// we have nice Display representations of the error, so we wrap "main" (run) and print any error.
+// https://github.com/shepmaster/snafu/issues/110
+fn main() {
+    if let Err(e) = run() {
+        eprintln!("{}", e);
+        process::exit(1);
+    }
+}
diff --git a/sources/api/migration/migrations/v1.15.0/aws-control-container-v0-7-4/Cargo.toml b/sources/api/migration/migrations/v1.15.0/aws-control-container-v0-7-4/Cargo.toml
new file mode 100644
index 00000000000..ab2a9e982d3
--- /dev/null
+++ b/sources/api/migration/migrations/v1.15.0/aws-control-container-v0-7-4/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "aws-control-container-v0-7-4"
+version = "0.1.0"
+authors = ["Zac Mrowicki <mrowicki@amazon.com>"]
+license = "Apache-2.0 OR MIT"
+edition = "2021"
+publish = false
+# Don't rebuild crate just because of changes to README.
+exclude = ["README.md"]
+
+[dependencies]
+migration-helpers = { path = "../../../migration-helpers", version = "0.1.0"}
diff --git a/sources/api/migration/migrations/v1.15.0/aws-control-container-v0-7-4/src/main.rs b/sources/api/migration/migrations/v1.15.0/aws-control-container-v0-7-4/src/main.rs
new file mode 100644
index 00000000000..ff9b8de4710
--- /dev/null
+++ b/sources/api/migration/migrations/v1.15.0/aws-control-container-v0-7-4/src/main.rs
@@ -0,0 +1,27 @@
+use migration_helpers::common_migrations::ReplaceTemplateMigration;
+use migration_helpers::{migrate, Result};
+use std::process;
+
+const OLD_CONTROL_CTR_TEMPLATE: &str =
+    "{{ ecr-prefix settings.aws.region }}/bottlerocket-control:v0.7.3";
+const NEW_CONTROL_CTR_TEMPLATE: &str =
+    "{{ ecr-prefix settings.aws.region }}/bottlerocket-control:v0.7.4";
+
+/// We bumped the version of the default control container
+fn run() -> Result<()> {
+    migrate(ReplaceTemplateMigration {
+        setting: "settings.host-containers.control.source",
+        old_template: OLD_CONTROL_CTR_TEMPLATE,
+        new_template: NEW_CONTROL_CTR_TEMPLATE,
+    })
+}
+
+// Returning a Result from main makes it print a Debug representation of the error, but with Snafu
+// we have nice Display representations of the error, so we wrap "main" (run) and print any error.
+// https://github.com/shepmaster/snafu/issues/110
+fn main() {
+    if let Err(e) = run() {
+        eprintln!("{}", e);
+        process::exit(1);
+    }
+}
diff --git a/sources/api/migration/migrations/v1.15.0/public-admin-container-v0-11-0/Cargo.toml b/sources/api/migration/migrations/v1.15.0/public-admin-container-v0-11-0/Cargo.toml
new file mode 100644
index 00000000000..a27ac1930fb
--- /dev/null
+++ b/sources/api/migration/migrations/v1.15.0/public-admin-container-v0-11-0/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "public-admin-container-v0-11-0"
+version = "0.1.0"
+authors = ["Zac Mrowicki <mrowicki@amazon.com>"]
+license = "Apache-2.0 OR MIT"
+edition = "2021"
+publish = false
+# Don't rebuild crate just because of changes to README.
+exclude = ["README.md"]
+
+[dependencies]
+migration-helpers = { path = "../../../migration-helpers", version = "0.1.0"}
diff --git a/sources/api/migration/migrations/v1.15.0/public-admin-container-v0-11-0/src/main.rs b/sources/api/migration/migrations/v1.15.0/public-admin-container-v0-11-0/src/main.rs
new file mode 100644
index 00000000000..beb681dad89
--- /dev/null
+++ b/sources/api/migration/migrations/v1.15.0/public-admin-container-v0-11-0/src/main.rs
@@ -0,0 +1,25 @@
+use migration_helpers::common_migrations::ReplaceStringMigration;
+use migration_helpers::{migrate, Result};
+use std::process;
+
+const OLD_ADMIN_CTR_SOURCE_VAL: &str = "public.ecr.aws/bottlerocket/bottlerocket-admin:v0.10.2";
+const NEW_ADMIN_CTR_SOURCE_VAL: &str = "public.ecr.aws/bottlerocket/bottlerocket-admin:v0.11.0";
+
+/// We bumped the version of the default admin container
+fn run() -> Result<()> {
+    migrate(ReplaceStringMigration {
+        setting: "settings.host-containers.admin.source",
+        old_val: OLD_ADMIN_CTR_SOURCE_VAL,
+        new_val: NEW_ADMIN_CTR_SOURCE_VAL,
+    })
+}
+
+// Returning a Result from main makes it print a Debug representation of the error, but with Snafu
+// we have nice Display representations of the error, so we wrap "main" (run) and print any error.
+// https://github.com/shepmaster/snafu/issues/110
+fn main() {
+    if let Err(e) = run() {
+        eprintln!("{}", e);
+        process::exit(1);
+    }
+}
diff --git a/sources/api/migration/migrations/v1.15.0/public-control-container-v0-7-4/Cargo.toml b/sources/api/migration/migrations/v1.15.0/public-control-container-v0-7-4/Cargo.toml
new file mode 100644
index 00000000000..b124832f7f6
--- /dev/null
+++ b/sources/api/migration/migrations/v1.15.0/public-control-container-v0-7-4/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "public-control-container-v0-7-4"
+version = "0.1.0"
+authors = ["Zac Mrowicki <mrowicki@amazon.com>"]
+license = "Apache-2.0 OR MIT"
+edition = "2021"
+publish = false
+# Don't rebuild crate just because of changes to README.
+exclude = ["README.md"]
+
+[dependencies]
+migration-helpers = { path = "../../../migration-helpers", version = "0.1.0"}
diff --git a/sources/api/migration/migrations/v1.15.0/public-control-container-v0-7-4/src/main.rs b/sources/api/migration/migrations/v1.15.0/public-control-container-v0-7-4/src/main.rs
new file mode 100644
index 00000000000..6aa6e0ae18b
--- /dev/null
+++ b/sources/api/migration/migrations/v1.15.0/public-control-container-v0-7-4/src/main.rs
@@ -0,0 +1,25 @@
+use migration_helpers::common_migrations::ReplaceStringMigration;
+use migration_helpers::{migrate, Result};
+use std::process;
+
+const OLD_CONTROL_CTR_SOURCE_VAL: &str = "public.ecr.aws/bottlerocket/bottlerocket-control:v0.7.3";
+const NEW_CONTROL_CTR_SOURCE_VAL: &str = "public.ecr.aws/bottlerocket/bottlerocket-control:v0.7.4";
+
+/// We bumped the version of the default control container
+fn run() -> Result<()> {
+    migrate(ReplaceStringMigration {
+        setting: "settings.host-containers.control.source",
+        old_val: OLD_CONTROL_CTR_SOURCE_VAL,
+        new_val: NEW_CONTROL_CTR_SOURCE_VAL,
+    })
+}
+
+// Returning a Result from main makes it print a Debug representation of the error, but with Snafu
+// we have nice Display representations of the error, so we wrap "main" (run) and print any error.
+// https://github.com/shepmaster/snafu/issues/110
+fn main() {
+    if let Err(e) = run() {
+        eprintln!("{}", e);
+        process::exit(1);
+    }
+}
diff --git a/sources/models/shared-defaults/aws-host-containers.toml b/sources/models/shared-defaults/aws-host-containers.toml
index 04bc47c3a40..222ab4f9edd 100644
--- a/sources/models/shared-defaults/aws-host-containers.toml
+++ b/sources/models/shared-defaults/aws-host-containers.toml
@@ -4,7 +4,7 @@ superpowered = true
 
 [metadata.settings.host-containers.admin.source]
 setting-generator = "schnauzer settings.host-containers.admin.source"
-template = "{{ ecr-prefix settings.aws.region }}/bottlerocket-admin:v0.10.2"
+template = "{{ ecr-prefix settings.aws.region }}/bottlerocket-admin:v0.11.0"
 
 [metadata.settings.host-containers.admin.user-data]
 setting-generator = "shibaken generate-admin-userdata"
@@ -15,4 +15,4 @@ superpowered = false
 
 [metadata.settings.host-containers.control.source]
 setting-generator = "schnauzer settings.host-containers.control.source"
-template = "{{ ecr-prefix settings.aws.region }}/bottlerocket-control:v0.7.3"
+template = "{{ ecr-prefix settings.aws.region }}/bottlerocket-control:v0.7.4"
diff --git a/sources/models/shared-defaults/public-host-containers.toml b/sources/models/shared-defaults/public-host-containers.toml
index 11f8440a6d0..d01d829ae57 100644
--- a/sources/models/shared-defaults/public-host-containers.toml
+++ b/sources/models/shared-defaults/public-host-containers.toml
@@ -6,9 +6,9 @@
 [settings.host-containers.admin]
 enabled = false
 superpowered = true
-source = "public.ecr.aws/bottlerocket/bottlerocket-admin:v0.10.2"
+source = "public.ecr.aws/bottlerocket/bottlerocket-admin:v0.11.0"
 
 [settings.host-containers.control]
 enabled = false
 superpowered = false
-source = "public.ecr.aws/bottlerocket/bottlerocket-control:v0.7.3"
+source = "public.ecr.aws/bottlerocket/bottlerocket-control:v0.7.4"